API Key Security
What you should know about your API key and how it is handled.
Gemini Access Is 18+ Only
Gemini-powered features on MedHall (including tool analysis, MedHall Brain, and the voice and image features) are restricted to users aged 18 or older. Before the first Gemini request, MedHall asks you to confirm that you are 18+. That confirmation is your own self-confirmation: MedHall does not verify your identity or your age and collects no personal information for it, and the Gemini API is called with your own API key from your own browser.
What happens to my key?
It is kept in your browser's localStorage on your own device after you connect, so it returns automatically on your next visit. MedHall does not save it on any server. Press Disconnect (or clear your browser data) to remove it from storage.
Does MedHall receive it?
No. In BYOK mode, your browser connects directly to the AI provider. Your AI provider key is never sent to MedHall's server, APIs, or logs; the image relay's Cloudflare Account ID and API Token are separate credentials and are relayed through the site's own relay endpoint, as described in the Free Engine & AI Image Data Policy.
Does MedHall store it?
Not by MedHall. The key is stored ONLY in your browser's localStorage on your device (a client-side value you control). It is never written to cookies, databases, server storage, logs, or build artifacts. Because it lives on your device, it is accessible to anyone who can use your browser — it is not a server-side secret.
Does the AI provider receive it?
Yes. The provider you select receives the credential as needed to authenticate the request sent directly from your browser. This is the intended flow.
Who is responsible for the key?
You are responsible for protecting your provider account and credentials. Never share your key publicly.
What if I remove the key?
Pressing Disconnect removes the key from your browser's localStorage immediately, and from the running app at once. Until you press Disconnect, the key stays saved in this browser on this device — refreshing the page, opening a new tab, or closing and reopening the browser does NOT remove it, so anyone who can use this browser can read the key. Clearing your browser storage also removes it, and it is never sent to MedHall.
Uploads and Voice Use Only Your Own Key
The upload and voice features follow the exact same BYOK flow: any file, image, or audio recording you use is sent only to the AI provider using the key you connected — never to MedHall. Your key is never duplicated, stored server-side, or used by MedHall for anything else.
Instagram:@medhallofficialTelegram:t.me/medhalll